CWE-105, Struts: Form Field Without Validator, is about coverage. The product has a form field that is not validated by a corresponding validation form, which can introduce other weaknesses related to insufficient input validation.
MITRE puts the stakes this way: omitting validation for even a single input field may give attackers the leeway they need to compromise the product.
How it happens
A form bean grows over time. Someone adds a discountCode field for a promotion, wires it into the action, and forgets to add a field entry in the validation configuration.
public class CheckoutForm extends ValidatorForm {
private String quantity;
private String discountCode; // added later, no validation rule
}
<form name="checkoutForm">
<field property="quantity" depends="required,integer"/>
<!-- no entry for discountCode -->
</form>
The form still passes validation, because the framework only checks what it is told about. A related MITRE point covers the unused fields: if unused fields are not validated, shared business logic in an action may let attackers bypass the checks performed for other uses of the form.
What an attacker gains
MITRE lists an unexpected state, and a bypass of protection mechanisms through shared logic. The unchecked field becomes the entry for whatever the downstream code does with it. MITRE also repeats the J2EE note that an input mistake could be used to launch a buffer overflow if native code that lacks bounds checking is involved.
How to find it
MITRE does not list a dedicated detection method for this entry. A practical check is to compare each form bean's properties with the fields in the matching validation entry and list anything present in the bean but absent from the XML.
How to fix it
MITRE's guidance: validate all form fields. If a field is unused, it is still important to constrain it so that it is empty or undefined.
<form name="checkoutForm">
<field property="quantity" depends="required,integer"/>
<field property="discountCode" depends="maxlength">
<arg position="0" name="maxlength" key="${var:maxlength}" resource="false"/>
<var><var-name>maxlength</var-name><var-value>12</var-value></var>
</field>
</form>
Add the check to code review: any new property on a form bean needs a matching rule in the same change.
Quick check
Should unused fields be validated too?
Yes. MITRE says to constrain them so they are empty or undefined, since shared logic in an action may let attackers use them to bypass checks.
